Accessible online stores: who does the 2025 law cover?

The accessibility law applies to online stores and other online interfaces used to conclude consumer contracts, not to every company website. Act XVII of 2022 (2022. évi XVII. törvény) has applied since 28 June 2025, and a service provider that is a microenterprise is exempt from it.

Two misleading assumptions

Two assumptions are especially misleading: that every small business website must be rebuilt immediately, and that the first mistake brings a heavy fine. Working from the text of the act and its implementing decree, we look at who is affected, what it asks for, and what to check before the Christmas season.

Which law are we talking about?

In Hungary, the EU accessibility directive (the European Accessibility Act, EAA) is transposed by Act XVII of 2022. Under section 10 it entered into force on 28 June 2025, and the detailed rules are set out in Government Decree 605/2022 (XII. 28.).

According to the European Commission's summary, e-commerce is among the services covered by the directive. The Hungarian text defines this precisely, so it is worth reading that.

Who is covered: online stores yes, brochure sites usually not

Section 1 (2) f) of the act covers e-commerce services provided to consumers. Section 2 point 11 defines this as a service provided at a distance, through websites or mobile-device-based services, by electronic means, at the individual request of the consumer, to conclude a consumer contract.

In practice this covers the online store, ordering through a mobile app, and online booking that creates a consumer contract. A website that only presents the company and at most offers a contact form is not covered by itself.

Ordering interfaces for businesses only

The definition is built on the consumer contract. An ordering interface that serves businesses only may therefore be judged differently, so clarify this with a lawyer.

Who is covered even without an online store?

In some sectors, compliance is required even without e-commerce. Under section 1 (2) a), b), d) and e), these are electronic communications services, services providing access to audiovisual media services, retail banking services, and e-books and dedicated software.

Point c) covers air, bus, rail and waterborne passenger transport, websites included. For urban, suburban and regional transport, however, it covers only self-service terminals.

Public sector websites are governed by a separate law, Act LXXV of 2018.

When is a business exempt?

Under section 3 (3), a service provider that is a microenterprise does not have to meet the requirements in points 3 and 4 of Annex 1, and is also released from the related obligations.

Under section 2 point 28, a microenterprise employs fewer than 10 people and has an annual net turnover or balance sheet total of at most the forint equivalent of 2 million euros. Both conditions must be met, so a web shop with 12 employees is not exempt even with low turnover.

The disproportionate burden exception

Under section 5, the requirements apply only as long as they do not call for a fundamental alteration of the essential characteristics of the service and do not impose a disproportionate burden. Anyone who has received external accessibility funding cannot claim a disproportionate burden.

The exception needs a written assessment, reviewed at least every five years, kept for five years after the service was last provided, and open to examination by the authority. Except for microenterprises, the business must also inform the authority.

What about stores launched before 2025?

Under section 11, the act applies to services provided after its entry into force. A web shop that still takes orders today still provides the service today, so older stores are covered too.

You may hear that there is a grace period until 2030. Section 12 (2) does grant one until 28 June 2030, but only for service contracts concluded before 28 June 2025, until they expire.

Section 12 (1) excludes archived content that is no longer updated. Neither provides an exemption for a live checkout process.

Who enforces it, and how?

Section 1 (1) f) of Decree 605/2022 designates the consumer protection authority for e-commerce services. Under section 8 (6) of the act, a consumer can also start proceedings before the authority or a court.

Section 8 (7) lets consumer protection and disability advocacy organisations bring proceedings too, if the breach affects a larger group of consumers. Sanctions are not immediate: under section 8 (3), the authority may issue a warning and opens a consultation on the deadline for the fix.

It imposes an administrative fine under section 8 (4) only if the business does not cooperate or does not fix the problem within the deadline.

How big can the fine be?

Under section 9 (1) of the decree, the fine is at least HUF 15,000. For SMEs and companies with turnover of at most HUF 100 million, the upper limit is, as a rule, HUF 500,000.

If the breach harms or endangers the physical safety or health of a wide range of consumers, or causes a wide range of consumers significant financial loss, the upper limit is 5 percent of annual net turnover.

For companies outside the SME category with turnover above HUF 100 million, the upper limit is 5 percent of annual net turnover, up to HUF 500 million.

What does the law say about standards?

The act does not name a specific technical standard. Under section 4 (1), a service that conforms to a harmonised standard is presumed compliant, once a reference to that standard is published in the Official Journal of the EU.

Under point 3.3 of Annex 1, the website must be perceivable, operable, understandable and robust. Under point 4.7, the same applies to identification, security and payment functions.

Point 4.7 also asks the store to provide information on the accessibility of the products and services it sells, if the responsible economic operator supplies that information.

EN 301 549 and WCAG 2.2

The practical benchmark is the European standard EN 301 549. The currently referenced version V3.2.1 is based on WCAG 2.1 levels A and AA, while V4.1.1, published on 2 September 2026, is based on WCAG 2.2.

According to Ireland's National Disability Authority (NDA), the new version gains legal weight once it is referenced in the Official Journal of the EU, and until then V3.2.1 remains in force. The reference is expected at the end of 2026.

So today WCAG 2.2 AA is the sensible target: it builds on WCAG 2.1, and the new standard adopts it.

Self-check: content and navigation

• Contrast: normal text needs a contrast ratio of at least 4.5:1 against its background, large text at least 3:1 (WCAG 1.4.3). Check prices, faint helper text and button labels.
• Keyboard: the whole purchase, from filters to payment, should be doable without a mouse (2.1.1). Focus must always be visible (2.4.7) and not fully hidden by a sticky header or cookie bar (2.4.11).
• Alternative text: every product image and icon button needs a text equivalent (1.1.1). A file name is not alt text.
• Forms: every field needs a label or instruction (3.3.2), and the system must name an error in text (3.3.1), not just with a red border.

Self-check: the checkout

• Redundant entry: data already entered in the same process should not have to be typed again (3.3.7).
• Sign-in: authentication should not require solving a task in your head, unless there is an alternative or assistance (3.3.8).
• Target size: clickable elements should be at least 24×24 CSS pixels or have enough spacing around them (2.5.8).
• Custom controls: the name, role and state of buttons, dropdowns and payment modules must be available to a screen reader (4.1.2).

Automated tests and embedded modules

Automated checkers find some of the problems, but it is worth walking through the checkout yourself with a keyboard and a screen reader.

Under section 3 (4), the provider is responsible for compliance even if part of the service is supplied by a subcontractor. So review embedded payment and shipping modules as well.

The accessibility statement

Under Annex 3 of the act, the provider must describe in the general terms and conditions, or an equivalent document, how the service meets the accessibility requirements.

At a minimum, this means a general description of the service in an accessible format, the explanations needed to understand how it works, and a description of how it meets the requirements.

This can be handled with a separate accessibility page that is also linked from the terms and conditions (ÁSZF). It is worth listing the known shortcomings, the planned time of the fix, and a contact point where customers can report problems.

Why now, at the start of October?

In 2026, Black Friday falls on 27 November. If the audit happens in October, the fixes can go live before the season, and you do not have to touch the checkout in the busiest period.

If you would like us to review your store's checkout process and prepare a list of fixes, take a look at our e-commerce development service.

This article is for information only and is not legal advice. If you are unsure whether your business counts as a microenterprise, ask your accountant or your lawyer.

Sources

• Act XVII of 2022 on the general rules of compliance with accessibility requirements for products and services (National Legal Database, in Hungarian)
• Government Decree 605/2022 (XII. 28.) on the implementation of Act XVII of 2022 (in Hungarian)
• European Accessibility Act (European Commission)
• EN 301 549 V4.1.1 published (National Disability Authority, Ireland)

Further sources

• European Accessibility Act ICT standards update (Davis Wright Tremaine, 18 September 2026)
• EN 301 549 v4.1.1 is final (Deque)
• Web Content Accessibility Guidelines (WCAG) 2.2 (W3C)
• What's New in WCAG 2.2 (W3C WAI)
• Act LXXV of 2018 on the accessibility of websites and mobile applications of public sector bodies (National Legal Database, in Hungarian)
• Understanding SC 1.4.3 Contrast (Minimum) (W3C WAI)